Description
fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or cloud metadata endpoints through redirect-following OkHttp requests and read back page titles, meta descriptions and favicons.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
lhccong fish-island-backend
Default version status: unaffected
0 to ≤ 7c61b7861e99d3970beb34103c244b79e4de7d88affected
pkg:github/lhccong/fish-island-backendReferences
- https://hackmd.io/@hieuPenguinnn/fish-island-web-parse-unauth-ssrf ↗
- https://github.com/lhccong/fish-island-backend/blob/7c61b7861e99d3970beb34103c244b79e4de7d88/src/main/java/com/cong/fishisland/service/impl/chat/WebParserServiceImpl.java#L28-L45 ↗
- https://github.com/lhccong/fish-island-backend/blob/7c61b7861e99d3970beb34103c244b79e4de7d88/src/main/java/com/cong/fishisland/controller/chat/WebParserController.java#L13-L25 ↗
- https://github.com/lhccong/fish-island-backend/blob/7c61b7861e99d3970beb34103c244b79e4de7d88/src/main/java/com/cong/fishisland/config/CorsConfig.java#L33 ↗
- https://www.vulncheck.com/advisories/fish-island-backend-through-commit-7c61b78-ssrf-via-api-web-parse ↗